--- type: Leaf title: "Application take-over checklist: what to check before you inherit software" description: "What to check before you take over software another team built: access, code, infrastructure, security and documentation. Print it and tick it off." resource: https://nationaldigital.com.au/software-support/application-support/application-take-over-checklist/ tags: - software-support - Software support and modernisation - Application support - application take over checklist - take over an existing application - inherited application checklist - software handover checklist - legacy application review timestamp: "2026-11-11T07:00:00.000Z" language: en-AU publisher: National Digital author: Cameron Young authorRole: CEO reviewedBy: Tara Buckley reviewedOn: "2026-11-11" readingTimeMinutes: 5 wordCount: 836 datePublished: "2026-11-11" dateModified: "2026-11-11" pillar: software_support canonical: https://nationaldigital.com.au/software-support/application-support/application-take-over-checklist/ sourceCount: 1 --- *5 min read · Updated 11 November 2026* # Application take-over checklist: what to check before you inherit software A printable checklist of what to check before taking over software another team built: access, code, infrastructure, security and documentation, with the cost. National Digital [designs, builds, hosts and supports](/about/) the platforms it delivers, with no reseller or integrator between the client and its engineers. **Where this page sits** · 2 of 22 areas Areas this page covers - Cloud, security & support - Application support [Open the full map on the homepage](/#systems-map-hero) **Quick answer:** A checklist of what to check before taking over software another team built: access and ownership, code, infrastructure, security and documentation, with the Platform Health Check and take-over costs. Software support and modernisation · Application support *Quick answer* ## What should you check before taking over an application another team built? *High confidence · Verified 11 Nov 2026* Check who owns the accounts and hosting, what the code is made of, where and how it runs, how it handles security, and whether the documentation lets a new engineer operate it. **Additional Context:** A Platform Health Check reports on these areas for a fixed fee and ends in one recommendation: support the platform, rebuild it in stages, or leave it as it is. ### Sources - [OAIC – Australian Privacy Principle 11: Security of personal information](https://www.oaic.gov.au/privacy/australian-privacy-principles/australian-privacy-principles-guidelines/chapter-11-app-11-security-of-personal-information) — APP 11 requires reasonable steps to protect personal information for as long as it is held, and to destroy or de-identify it once it is no longer needed. *Take-over checklist* ## How to use this checklist This checklist covers what to find out before you take over software that another team built. It follows the areas the [Platform Health Check](/services/platform-health-check/) reports on, with the access handover that comes before any work. Print the page and mark each box against the system. A box you cannot tick is a question for the previous owner, or for a health check. ## Access and ownership - \[ ] Who owns the hosting account, the domain and the code repositories, and are they named people or a supplier who has left? - \[ ] Which third-party services are wired in, and who holds the login for each? - \[ ] Where is each site or service hosted? - \[ ] Can the previous owner or provider hand over the accounts, the hosting and the repositories? Access handover brings the accounts, hosting, repositories and third-party services under the client's ownership. We start work on an inherited platform by building a register of the external services wired into it, with a recorded login owner for each. We establish where each site is hosted before any work begins. ## The code - \[ ] What is the platform made of, and how is it put together? - \[ ] Which dependencies are no longer maintained? - \[ ] How much of the code is covered by tests? ## The infrastructure - \[ ] Where does it run, and what does it cost to run? - \[ ] How is it deployed? - \[ ] What would happen if the account holding it were lost? *Security and documentation* ## The security posture These are the checks that most often change the picture on an application nobody has opened for a while. Each is a question about the application, and the answer comes from reading the code. - \[ ] Does every endpoint require a login? - \[ ] Does the authorisation layer run at all? - \[ ] How does user input reach the database? - \[ ] What decides a user's level of access? - \[ ] Are identifiers doing the work of permissions? - \[ ] What does the application trust the browser to tell it? - \[ ] What happens on repeated failed logins? - \[ ] Are uploads and generated documents private? - \[ ] What are the dependencies and the runtime running? - \[ ] Where do the credentials and secrets live? - \[ ] Who and what can reach the server? ## The documentation - \[ ] Could an engineer who has never seen the platform operate it from what exists? - \[ ] Are the findings ranked by exposure, in the order they would be fixed? *Next step and cost* ## What the answers lead to The Platform Health Check ends in one recommendation with the reasoning written down: support the platform as it stands, rebuild it in stages, or leave it with whoever runs it today. ## What does a take-over cost? The Platform Health Check costs $3,950 ([Platform Health Check](/services/platform-health-check/)). Taking the system over after it costs $6,600 – $22,880 ([Taking over a system (per month, first quarter)](/services/rate-card/)) a month for each of the three months of the first quarter. The [project estimator](/estimate/) has a take-over option that prints the same band. [Every price National Digital publishes is in Australian dollars and excludes GST](/services/rate-card/). [A price range from National Digital is an indication and is not a quote](/estimate/). ## Find out what you own Start with a Platform Health Check. It reports on the code, infrastructure, security and documentation of the system you are taking over. - [Book a consultation](https://calendly.com/cameron-at-national-digital/discovery) - [See the Platform Health Check](/services/platform-health-check/) or · [1300 800 855](tel:+611300800855) ## Take-over questions ### What should I check before taking over an application? Check who owns the accounts, the hosting and the repositories, what the code is made of, where it runs, how it handles security and whether an engineer who has never seen it could operate it from the documentation. The checklist on this page lists each question. ### How much does it cost to take over an application? A take-over starts with the Platform Health Check, a fixed-fee review of the code, infrastructure, security and documentation. It costs $3,950 ([Platform Health Check](/services/platform-health-check/)). Taking the system over afterwards costs $6,600 – $22,880 ([Taking over a system (per month, first quarter)](/services/rate-card/)) a month for the first quarter, ex GST. ### What does the Platform Health Check recommend? One of three outcomes, with the reasoning written down: support the platform as it stands, rebuild it in stages, or leave it with whoever runs it today. The report is the client's to keep. Written by [Cameron Young](/about/cameron-young/), CEO Reviewed by [Tara Buckley](/about/tara-buckley/), COO, on 11 November 2026 ## Related reading - [The legacy app nobody is maintaining is still holding customer data](/software-support/application-support/unmaintained-application-security/) ## Related **Parent:** - [Application support and maintenance for software you did not build](/okf/software-support/application-support.md) # Citations 1. [OAIC – Australian Privacy Principle 11: Security of personal information](https://www.oaic.gov.au/privacy/australian-privacy-principles/australian-privacy-principles-guidelines/chapter-11-app-11-security-of-personal-information) — APP 11 requires reasonable steps to protect personal information for as long as it is held, and to destroy or de-identify it once it is no longer needed.